Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 2 May 2023 13:56:02 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Cc:     Neil Horman <nhorman@tuxdriver.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
        Xin Long <lucien.xin@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        "linux-sctp@vger.kernel.org" <linux-sctp@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: Re: [PATCH] sctp: fix a potential buffer overflow in
 sctp_sched_set_sched()
Message-ID: <ZFD6UgOFeUCbbIOC@corigine.com>
References: <20230502082622.2392659-1-Ilia.Gavrilov@infotecs.ru>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230502082622.2392659-1-Ilia.Gavrilov@infotecs.ru>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Na+DR/3S1I1adMnAdPP6PCYjhE8aqj+xeQG+/hHnwASUjDNgIL5zfw8CnN6V?=
 =?us-ascii?Q?OCfHa/pgQk+utvltD48JCupZ+nF24U6vVLs/mKkEKvnrkxdSJgaOF/7v5DIB?=
 =?us-ascii?Q?fN2hLkXTMtWgt3YdxHzPyA9tOKZppSrWyYDO2lnhIEIn9TuLOlVeJ11K9neK?=
 =?us-ascii?Q?0+BuBswvt9E2rKhfxculJ2uB3MvAvv0Vl8Mq8F7LlBm1ISRvMRXktNl5DH4Y?=
 =?us-ascii?Q?Alrt79f1k3nMDawM44cJzKUhGQ0pZSPeVlbcsWiRWVQlmLUJNOYWXcNucHWl?=
 =?us-ascii?Q?DcIX2v4e1ol6UUblb1KJd+O6/d/wbwaKAWkSVuCOdbiaXoVTTIz2e/zWCBY9?=
 =?us-ascii?Q?2JO5R3gHDgoPQPMSanAO6ckhATja5TuxWWVtimIfZpehVj4y7hVtkcGhOgst?=
 =?us-ascii?Q?6wbLQRwdA+8bEPuKWEUdRUFt0Fw0XgEEcInjC0HCTKKy/h0fKspsEat5NTLT?=
 =?us-ascii?Q?knfw3ygnyy3xo/y1Fwt++Da4nsBF2q4sP/j2KXdzslOnPAFgj+Q/P/o0rmf5?=
 =?us-ascii?Q?OChyfh+W/cl1i4LAfQAdPW7fRSsERPtJvPonw1nvSFe8P2w6a7kFuMUimQOn?=
 =?us-ascii?Q?gzqefVM5zwQd65FPZis9D1VGkkz3UdJOgYJcd8dRWv7EH03Fq+jX7BgsUksR?=
 =?us-ascii?Q?kYgxxLDpflsaluqUoW48bxKxgm09aVx64YFIQB3eCj7EZT/Y0viTOw9m8cgz?=
 =?us-ascii?Q?R0Uug9oDQanmzGOTcPiz5FBhI9r+lKObr3u/Y3OnpZsROJ8s9XLGvD9djmEl?=
 =?us-ascii?Q?RobnAJC4iKMiLkHVDv8awomWsHh8VwKKmi5qTi13IMlFwJ2dAEl96Pas1FOw?=
 =?us-ascii?Q?LiVD2oACBFSxNZGuSgENzQq9XW5Y08538q+9SJdnszNnj3ydaSb9yxgkG83Z?=
 =?us-ascii?Q?NhTew0nZRhiVnZ3Ldr+HCo6yKipIAII+NE9WfW3xfzAueEouYOdTJ0gg6vLc?=
 =?us-ascii?Q?IzLVNIdx9ik6Xp9TSYTs6tuP2MSJDjAHKRNzjIVXjeaCfj9Y087OzE5MWLcu?=
 =?us-ascii?Q?3FC3KkNKqoFRzLelhF4kOrnkyGPfSisqyMzuPSmjyewUvGFnKA00P1GDkZU+?=
 =?us-ascii?Q?eNsHWquGe/qs9fwVNlxZQHOlPNFcE6kkICRCMaN5ruwOfOATc0OYG6ufk0J0?=
 =?us-ascii?Q?S5TOWV2Tw6VOIj1HC7JGfVS/kPg8BN34hrA2yj8Id7m7/8wBfsgTKpC7+NhT?=
 =?us-ascii?Q?XYXHY9GT7Msx2ctXEqpnPLGJ7Pmj1zjTK5JDeqBiGXZeIhhacxtqjFuhzjxN?=
 =?us-ascii?Q?1gtZMm4tqw3Yuc08diVrnMIohI6dIpJX2oQm0C2cQcZslunK85enoJ7OyH5n?=
 =?us-ascii?Q?mcXYmQ20V5iyJ6XL+qK0TLch1LIt7R5580Gv9b5nveYkhjyfn37rFSMVzSsZ?=
 =?us-ascii?Q?P6M6G4Wl8sszevdeOe01Nipt8JUh3m80j29cRlL7IzHjswetJCJFEXuAT+1i?=
 =?us-ascii?Q?XRhgj48jOMFwFZLp/ZVZX58+npV6UaH8n98auK6zwitiZ3Sb2PskRKjXEla3?=
 =?us-ascii?Q?iOl5gdrpZUPpqyPazPiJ59bG/WBo/B+CkebtqshUxK+TcvsxDB4ub5ykWo13?=
 =?us-ascii?Q?n6s2Q75L0gD2s4BWJRluJrGdRHRjc/gdex94QXE0yeWmewKz+pxE5qNMfKps?=
 =?us-ascii?Q?t83ymq8v2WpPMWpWa7beQ47YzFEr+kqaCCi9o3BQtK09eaTqfjnVB7ZC182E?=
 =?us-ascii?Q?qWdiaA=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ec41c4d0-e8dc-4540-eacd-08db4b04373a
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2023 11:56:08.2686
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: sDDLd51b/H5uBWDLP5XGXWqDoZYFOrN06w6dFDu0vxGiFBai7ZVzxNCx0kkgWepCKavQ10TMn08FkHAbTNtS92adLOpHw6rFxm+2XRatqWU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR13MB4721
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, May 02, 2023 at 08:26:30AM +0000, Gavrilov Ilia wrote:
> The 'sched' index value must be checked before accessing an element
> of the 'sctp_sched_ops' array. Otherwise, it can lead to buffer overflow.
> 
> Note that it's harmless since the 'sched' parameter is checked before
> calling 'sctp_sched_set_sched'.
> 
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
> 
> Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
> Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

> ---
>  net/sctp/stream_sched.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c
> index 330067002deb..a339917d7197 100644
> --- a/net/sctp/stream_sched.c
> +++ b/net/sctp/stream_sched.c
> @@ -146,18 +146,19 @@ static void sctp_sched_free_sched(struct sctp_stream *stream)
>  int sctp_sched_set_sched(struct sctp_association *asoc,
>  			 enum sctp_sched_type sched)
>  {
> -	struct sctp_sched_ops *n = sctp_sched_ops[sched];
> +	struct sctp_sched_ops *n;

nit: reverse xmas tree - longest line to shortest - for local variable
     declarations in networking code.

>  	struct sctp_sched_ops *old = asoc->outqueue.sched;
>  	struct sctp_datamsg *msg = NULL;
>  	struct sctp_chunk *ch;
>  	int i, ret = 0;
>  
> -	if (old == n)
> -		return ret;
> -
>  	if (sched > SCTP_SS_MAX)
>  		return -EINVAL;
>  
> +	n = sctp_sched_ops[sched];
> +	if (old == n)
> +		return ret;
> +
>  	if (old)
>  		sctp_sched_free_sched(&asoc->stream);
>  
> -- 
> 2.30.2
>